Market abuse and statistical fraud detection

Barry Quinn PhD CStat

Outline

Capital market importance
Theory of a market
Types of market abuse
Some detection examples
UK statistics for market abuse

Global capital markets

Figure 1 is high-level view of financial markets’ importance.
Trust and integrity are foundational to their functioning of these markets.

Figure 1: Trends of size of global capital markets

Global Capital Market Spread

Economics 101

Buyers and sellers are assumed to be atomised; small relative to the market.
They believe as they are small nothing they do will affect the price.
Thus they are willing to express their true preferences; be honest about how much they will buy/sell at a given price.
Thus Figure 3 illustrates how these buyers/sellers collectively define the demand/supply curve.
Equilibrium price and quantity are thus when the quantity demanded equals the quantity supplied; at (P_eq,Q_eq)

Economics 101

In principle the process of arriving at an equilibrium point is accomplished by an auctioneer.
Auctioneer calls out the price and asks:
Who wants to buy at this price ?
Who wants to sell at this price ?
Auctioneer then adjust the price until supply and demand are in balance.
And the market clears.

Economics 101

Stock markets are often mentioned as settings that closely approximate this ideal.
Stocks are held by thousands of investors and thousands more might be standing by as potential investors.
In reality though this model breaks down.
Millions of people may hold securities but few may actively participate in the market when we wanted to trade.
There may be as few as two; you and a counterparty.

Economics 101

Now, the large number of perfect competition ideals breaks down, and market participants’ behaviour becomes strategic:
This idea forms the basis of the theory of market microstructure.
Taking into account that their actions can now change the price (can endogenously determine prices)
We have seen how the largest part of trading costs is the adverse effect on prices; called the implementation shortfall.
The theory allows us to classify a illegal trader as an insider (some with private information).
Most of the time, there is no one acting as Auctioneer.
Most trading occurs during continuous trading sessions.
In these interactions, the market procedures and rules matter very much.

Fraud and its evolution

Fraud, defined as criminal deception for unjust advantage, has evolved with technology (Bolton and Hand 2002).
Fraud detection usually works along side fraud prevention, where there is a necessity for detection methods when prevention fails.
Classic prevention methods include:

Elaborate designs on banknotes such as fluorescent fibers, multitone drawings, watermarks, laminated metal strips, and holograms.
Personal identification numbers (PINs) for bankcards.
Internet security systems for credit card transactions.
Subscriber Identity Module (SIM) cards for mobile phones.
Passwords for computer systems and telephone bank accounts.

Fraud detection is a continuous and evolving process, necessary because criminals adapt and develop new strategies to circumvent existing detection methods.

Key Illegal trading practices

Financial market trading
Illegal trading practices, including insider trading, closing price manipulation, and spoofing, undermine the financial market’s integrity.
There’s a growing body of empirical evidence highlighting various illegal trading strategies.(James, Leung, and Prokhorov 2023)

Definition of market abuse

Inside information is defined as non-public information that could significantly impact an investor’s decisions if it were public.
UK MAR prohibits using inside information for trading or influencing others to trade, including altering or canceling orders.
Unlawful disclosure of inside information under UK MAR is any non-employment related sharing of such information.
Disclosures during market soundings are protected under UK MAR, provided they adhere to regulatory requirements.
Market manipulation is explicitly forbidden by UK MAR, including attempts at manipulation and certain transactions in benchmarks and spot commodities.

Market manipulation definitions

Spoofing and closing price manipulation are both forms of market manipulation but they differ in their methods and objectives.
Spoofing is an especially prevasive problem in US stock markets where 97% of orders are cancelled before they trade (Khomyn and Putniņš 2021)
JP Morgan paid over $900Million in fines for spoofing activity in the commodities markets during 2008-2016 (Debie et al. 2023)

What is Spoofing

Definition: Spoofing involves placing large orders to buy or sell a security with no intention of executing them. The goal is to create a false impression of high demand or supply, thereby manipulating the market price.
Method: Traders place large orders that they plan to cancel before execution. These orders are usually placed just outside the current bid or ask price to influence other market participants without actually executing any trades.
Objective: The primary goal is to influence the behavior of other traders. For example, by creating an illusion of increased demand, the spoofer may drive up prices, at which point they can sell at an artificially inflated price.

Price impact of spoofing

- This is an actual FINRA manipulation case from 2016(Zhai, Cao, and Ding 2018)

In this example quote stuffing was used to create an impression of strong buying interest.

Market status: Ask price: 101.35; Bid price: 101.24.
The purpose of the manipulator is to execute a sell order at a high price of 101.32.
Step 1: Manipulator add a bona fide sell order with 1000 shares at 101.32.
Step 2: The manipulator adds a series of non-bona fide buy orders to push up the bid - price to 101.31.
Step 3: Some investors, encouraged by the (fake) bid price changes, responded to the sell order. Thus, some of the 1000 shares of the sell order are executed at the expected price of 101.32.
Step 4: The Manipulator cancelled all the buy orders. Thus, the bid price went down to 101.24.

Closing Price Manipulation

Definition: This involves conducting trades or placing orders near the market’s close to affect the closing price of a security.
Method: Trades are executed or orders are placed in the last moments of trading to influence the closing price. This can be done by either buying or selling in significant volumes.
Objective: The manipulation of the closing price can be used for several purposes, such as improving the appearance of a portfolio’s performance (since portfolios are often valued based on closing prices) or to influence the price of derivatives that are valued based on the underlying asset’s closing price.

Comparing Insider Trading with Spoofing & Closing Price Manipulation

Insider Trading
- Definition: Trading based on non-public, material information about a company.
- Method: Utilizing confidential info (e.g., about earnings, mergers) for trading.
- Objective: To profit or avoid loss using material, non-public information.
- Legal Aspect: Illegal due to breaching equal information access principles.
Spoofing & Closing Price Manipulation
- Nature: Creating false market activity impressions, not necessarily using non-public info.
- Objective: To manipulate market prices or volumes for personal gain.
- Legal Aspect: Illegal due to market manipulation, not based on confidential information exploitation.

Statistical fraud detection techniques

These techniques are not just reactive (detecting fraud after it has occurred) but can also be proactive, using predictive analytics to identify patterns that are indicative of fraudulent behavior before it causes widespread harm.

Market Surveillance Practices

Importance: Effective market surveillance is crucial for improving financial market quality.
Challenges: Identifying illegal trading activity is difficult due to the rarity of confirmed cases amidst legitimate transactions.
In Practice:
- Advanced Analytics: Utilization of sophisticated data analysis tools and algorithms to detect unusual trading patterns.
- Real-Time Monitoring: Continuous surveillance of market activities to quickly identify and investigate suspicious transactions.

Inudustry market surveillance tool

In practice market surveillance divsions use automated rule-based expert system algorithms such as NASDAQ SMARTS and ONETICK.
The goal being to kept the Type I error (false positive) rate of the as low as reasonably possible to ensure human analysts are not overwhelmed by false alerts.
These expert systems embed knowledge of illegal trading practices via a pre-set dictionary of human defined rules.
A weakness of these systems is that the structure of illegal trading activity needs to be well defined ex-ante

Academic detection approaches

Tradition detection approaches assume that insider trading moves prices because the insider’s private information is reveal to the market through the trading process
These approaches then use principled time series econometrics techniques such as ARMA(1,1)(Park 2010) or structural break analysis of a linear regression capital asset pricing models (Olmo 2011)
The limitation of these approaches is that they are designed to detect long-lived insider (illegal) trading over several months ahead of corporate announcements or unexpected news releases
More sophisticate anomaly detection algorithms such as Nearest Neighbour Dynamic Time Warping (James, Leung, and Prokhorov 2023), Ensemble Gaussian Mixture Model(Emmott et al. 2015), an Isolation Forest and One Class Support Vector Machine.
In a recent research collaboration with Citi Bank’s FX surveillance team we built a principled BERT model, which help to reduce their false positive rate for alerts.

UK Market Abuse Statistics

Up to 2017, the FCA published a single metric to gauge market abuse in equity trading.
Market cleanliness is the percentage of UK takeover announcements that show abnormal price movements in the 2-day period ahead of announcement.

UK Market Abuse Statistics

The above statistics is limited to equity trading only, and due to its small sample size, can be unreliable in times of high volatility.
Introduced in 2018/19, Abnormal Trading Volume Ratio (ATV) captures derivative trading where the underlying is the relevant equity.
It measures if there is a statistically significant difference in trading volumes between two periods: the Benchmark Period and the Announcement Period.
The test used is the Welch Variation of the standard T-Test, which is appropriate for samples of different sizes and likely unequal variances.
The ratio is calculated as the number of announcements where the null hypothesis (that there is no significant difference between trading volumes in the Benchmark and Announcement Periods) is rejected, divided by the total number of announcements tested

\[ATV(\%)=\frac{\text{No. of rejected Null hypothesis}}{\text{Total number of announcements tested}}\]

Abnormal Trading Volume Ratio | FCA

Abnormal Trading Ratio

UK Market Abuse Statistics

Finally, in financial year 2019/20 the FCA introduced the Potentially Anomalous Trading Ratio (PATR).
PATR examines trading around announcements with significant price changes (PPSNAs)¹.
It focuses on accounts demonstrating anomalous trading compared to their historical behavior.
Anomalous behavior includes not typically trading in the instrument, trading significantly more in the direction of the announcement, and significant profits from positions established just prior to the announcement.
The ratio is calculated as the value of trading activity considered potentially anomalous during the Pre-Announcement period over the total trading activity in the same period

PATR

Concluding remarks

Trader’s who act illegal can be thought of as be informed in theory, which can help make statistical detection more tractable.
There is a huge statistical imbalance in any labelled datasets used to build models as market abuse cases are rare (less than 1% in most dataset).
Regulatory must balance between public reporting of fraud cases and regulatory arbitrage of illegal traders.
More work is need to better understand the pyschology of a rogue trader.

References

Bolton, Richard J., and David J. Hand. 2002. “Statistical Fraud Detection: A Review.” Statistical Science 17 (3): 235–55. https://doi.org/10.1214/ss/1042727940.

Debie, Philippe, Cornelis Gardebroek, Stephan Hageboeck, Paul Leeuwen, Lorenzo Moneta, Axel Naumann, Joost M. E. Pennings, Andres A. Trujillo‐Barrera, and Marjolein E. Verhulst. 2023. “Unravelling the JPMorgan spoofing case using particle physics visualization methods.” European Financial Management 29 (1): 288–326. https://doi.org/10.1111/eufm.12353.

Emmott, Andrew, Shubhomoy Das, Thomas Dietterich, Alan Fern, and Weng-Keen Wong. 2015. “A Meta-Analysis of the Anomaly Detection Problem.” arXiv Preprint arXiv:1503.01158.

James, Robert, Henry Leung, and Artem Prokhorov. 2023. “A machine learning attack on illegal trading.” Journal of Banking & Finance 148: 106735. https://doi.org/10.1016/j.jbankfin.2022.106735.

Khomyn, Marta, and Tālis J. Putniņš. 2021. “Algos gone wild: What drives the extreme order cancellation rates in modern markets?” Journal of Banking & Finance 129 (August): 106170. https://doi.org/10.1016/j.jbankfin.2021.106170.

Olmo, Jose. 2011. “Detecting the presence of insider trading via structural break tests.” Journal of Banking and Finance.

Park, Young S. 2010. “Detecting insider trading: The theory and validation in Korea Exchange.” Journal of Banking and Finance.

Zhai, Jie, Yong Cao, and Xiaohui Ding. 2018. “Data Analytic Approach for Manipulation Detection in Stock Market.” Review of Quantitative Finance and Accounting 50: 897–932. https://doi.org/10.1007/s11156-017-0650-0.